{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/linux-kernel--6.12.58/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-98499"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Linux Kernel (\u003c 6.12.58)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-98499 is a kernel heap out-of-bounds (OOB) read vulnerability located in \u003ccode\u003ewacom_wac_pen_serial_enforce()\u003c/code\u003e. The flaw occurs when the driver processes HID descriptors with specific usage configurations, allowing an attacker to walk past the received report buffer. Exploitation results in the extraction of kernel memory values, which are delivered to userspace as \u003ccode\u003eMSC_SERIAL\u003c/code\u003e input events. A public proof-of-concept exists that demonstrates the information leak of KASLR slide and \u003ccode\u003euhid_device\u003c/code\u003e heap base on Linux kernels through version 6.12.58.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker ensures the process has write permissions to \u003ccode\u003e/dev/uhid\u003c/code\u003e (e.g., membership in \u003ccode\u003euhid\u003c/code\u003e group).\u003c/li\u003e\n\u003cli\u003eAttacker initializes a virtual HID device via \u003ccode\u003euhid\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker submits a maliciously crafted HID descriptor containing \u003ccode\u003eHID_DG_PEN\u003c/code\u003e, \u003ccode\u003eHID_DG_STYLUS\u003c/code\u003e, and \u003ccode\u003eHID_DG_TOOLSERIALNUMBER\u003c/code\u003e usages.\u003c/li\u003e\n\u003cli\u003eAttacker uses 2-byte usage items (\u003ccode\u003e0x1A\u003c/code\u003e/\u003ccode\u003e0x2A\u003c/code\u003e) to avoid truncation and trigger the OOB read loop.\u003c/li\u003e\n\u003cli\u003eThe wacom driver binds to the virtual device and processes the descriptor.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ewacom_wac_pen_serial_enforce()\u003c/code\u003e function accesses memory out-of-bounds due to an improper loop limit based on \u003ccode\u003efield-\u0026gt;maxusage\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eLeaked kernel memory values are written to \u003ccode\u003eMSC_SERIAL\u003c/code\u003e and reported to \u003ccode\u003e/dev/input/eventN\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker reads the \u003ccode\u003eMSC_SERIAL\u003c/code\u003e event from the input node to recover kernel pointers.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unprivileged local user to bypass KASLR and leak sensitive kernel heap pointers. While the current PoC lacks a write primitive, these leaks are critical prerequisites for more complex kernel exploitation chains.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the kernel immediately using upstream commit \u003ccode\u003e9aa237cf6649\u003c/code\u003e or stable branch fix \u003ccode\u003eeaa7d29341ef\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit system configurations for access to \u003ccode\u003e/dev/uhid\u003c/code\u003e. Restrict write access to this device node to only necessary and trusted service accounts to prevent local users from creating virtual HID devices.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for processes that interact with \u003ccode\u003e/dev/uhid\u003c/code\u003e and subsequently monitor \u003ccode\u003e/dev/input/event*\u003c/code\u003e nodes if those processes are not trusted HID services.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:21:59Z","date_published":"2026-11-07T06:21:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-linux-wacom-hid-oob/","summary":"A kernel heap out-of-bounds read vulnerability in the Linux wacom HID driver allows unprivileged users with access to /dev/uhid to leak KASLR slide and kernel heap addresses via maliciously crafted HID descriptors.","title":"Linux Kernel: Wacom HID driver out-of-bounds heap read (CVE-2026-98499)","url":"https://feed.craftedsignal.io/briefs/2026-11-linux-wacom-hid-oob/"}],"language":"en","title":"CraftedSignal Threat Feed - Linux Kernel (\u003c 6.12.58)","version":"https://jsonfeed.org/version/1.1"}